ShinyHunters Exploit PeopleSoft Flaw Bypassing WAFs Globally

Introduction

A significant escalation in cyber threat activity has been observed targeting enterprise resource planning (ERP) systems worldwide. Google's Threat Analysis Group (TAG) recently issued an alert detailing a renewed, large-scale exploitation campaign against a critical vulnerability in Oracle PeopleSoft. This operation, attributed to the financially motivated group ShinyHunters, demonstrates a sophisticated ability to circumvent perimeter defenses—specifically Web Application Firewalls (WAFs)—to establish persistent footholds via web shell deployment. The vulnerability, tracked as CVE-2024-35273 (CVSS 9.8), allows unauthenticated remote code execution, representing a worst-case scenario for organizations relying on PeopleSoft for core HR, finance, and supply chain operations.

This article dissects the mechanics of the campaign, the evasion techniques employed against WAFs, the threat actor profile, and the urgent defensive measures required to safeguard critical enterprise assets.

The Anatomy of the PeopleSoft Exploitation Campaign

The current wave of attacks is not an isolated incident but a continuation of activity first observed when the vulnerability was exploited as a zero-day. The flaw resides in the PeopleSoft Integration Broker component, specifically within the handling of inbound SOAP messages. By crafting malicious XML payloads, adversaries can deserialize arbitrary code on the underlying application server without requiring valid credentials.

What distinguishes this campaign is its scale and velocity. Telemetry indicates scanning and exploitation attempts originating from a distributed infrastructure targeting organizations across healthcare, education, government, and financial services sectors globally. The indiscriminate nature suggests an "spray-and-pray" approach to initial access, followed by selective post-exploitation activity on high-value targets.

• Vector: Unauthenticated HTTP/HTTPS requests to Integration Broker endpoints.
• Impact: Full server compromise, data exfiltration, lateral movement, and ransomware staging.
• Persistence: Deployment of custom web shells (JSP/ASPX/PHP depending on app server) for long-term access.

How Attackers Are Circumventing Web Application Firewalls

A hallmark of this campaign is the consistent bypass of WAF solutions deployed in front of PeopleSoft instances. Attackers are employing a combination of obfuscation and protocol-level manipulation techniques that render signature-based detection ineffective.

Key Evasion Techniques Observed

• Payload Fragmentation: Splitting the malicious SOAP envelope across multiple packets or using chunked transfer encoding to prevent the WAF from reassembling and inspecting the full payload.
• Encoding Layers: Applying nested encoding (Base64, URL encoding, Unicode escapes) within XML tags to obscure the serialized Java gadget chain responsible for code execution.
• Header Manipulation: Utilizing non-standard HTTP headers or malformed Content-Type declarations to confuse parser logic in the WAF while the backend application server processes the request normally.
• Benign-Looking Traffic Mimicry: Crafting requests that structurally resemble legitimate Integration Broker traffic, including valid message IDs and timestamps, blending into normal noise.

These techniques highlight a fundamental limitation of perimeter-based signature matching: the semantic gap between what the WAF inspects and what the application server ultimately executes.

The ShinyHunters Connection and Threat Actor Profile

Attribution to ShinyHunters (also tracked as UNC4962) is based on overlapping infrastructure, tooling, and tactical patterns. Historically known for data theft and extortion operations against SaaS providers and cloud environments, their pivot to on-premise ERP exploitation marks a strategic expansion.

ShinyHunters typically operates on an "access-as-a-service" model. Initial access brokers within the group compromise vulnerable instances, validate access, and then sell or lease the footholds to ransomware affiliates (such as LockBit or ALPHV/BlackCat) or conduct data extortion directly. The deployment of web shells rather than immediate ransomware encryption indicates a preference for stealthy persistence and data enumeration.

Infrastructure analysis reveals the use of compromised cloud hosting accounts and residential proxy networks to rotate source IPs, complicating blocking efforts and attribution.

Technical Breakdown of the Vulnerability and Web Shell Deployment

CVE-2024-35273 is a deserialization vulnerability in the PeopleSoft Integration Broker's messaging gateway. The gateway accepts external messages via HTTP(S) and processes them using Java's native serialization mechanism. Due to insufficient validation of the serialized object stream prior to deserialization, an attacker can inject a malicious object graph (a "gadget chain") that executes arbitrary operating system commands when deserialized.

Post-Exploitation Workflow

1. Initial Exploit: Send crafted SOAP request with serialized payload executing a command to download a web shell (e.g., via wget or curl).
2. Web Shell Deployment: The shell is written to a web-accessible directory under the PeopleSoft web root (e.g., PSIGW/ or custom servlet mappings).
3. Verification: Attacker accesses the shell URL to confirm execution context and permissions (often running as the PeopleSoft application server user, typically high privilege).
4. Credential Harvesting: Scripts query the PeopleSoft configuration files (configuration.properties, psftdb credentials) to access the underlying database directly.
5. Lateral Movement: Using database links, scheduled jobs, or trusted host relationships to pivot to adjacent systems.

The web shells observed are minimalistic, often single-file scripts providing a command interface, file manager, and database query tool, heavily obfuscated to evade host-based AV/EDR scanning.

Conclusion

The ShinyHunters campaign against Oracle PeopleSoft serves as a stark reminder that ERP systems remain high-value targets for sophisticated adversaries. The ability to bypass WAFs using standard evasion techniques against a known, patchable vulnerability highlights the gap between compliance-driven security ("we have a WAF") and effective resilience. Patching CVE-2024-35273 is non-negotiable, but it is only the baseline. True defense requires architectural hardening—segmentation, egress control, runtime protection, and behavioral detection—to ensure that when the next zero-day or WAF bypass emerges, the blast radius is contained.

At Grivyonx Cloud, we specialize in securing the AI and cyber intelligence infrastructure that powers modern enterprises. Our platform provides the behavioral analytics and automated response capabilities needed to detect and neutralize ERP-targeted threats before they escalate into business-disrupting incidents.